admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm/panthor: Fix UAF race between device unplug and FW event processing

Browse Source 
The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().

Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: de85488138 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251027140217.121274-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
This commit is contained in:
Ketil Johnsen
2025-10-27 15:02:15 +01:00
committed by Liviu Dudau
parent 94a6d20fea
commit 7051f6ba96
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/panthor/panthor_sched.c
View File

@@ -3878,6 +3878,7 @@ void panthor_sched_unplug(struct panthor_device *ptdev)
struct panthor_scheduler *sched = ptdev->scheduler;
cancel_delayed_work_sync(&sched->tick_work);
disable_work_sync(&sched->fw_events_work);
mutex_lock(&sched->lock);
if (sched->pm.has_ref) {